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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 
FORT GEORGE G. MEADE MARYLAND 20755-6000 


15 January 2013 

MEMORANDUM FOR THE CHAIRMAN. INTELLIGENCE OVERSIGHT BOARD 

THRU; Assistatil to tlie Secretarj' of Defense (Intelligence Oversight) 

SUBJECT: (UA^- 'QUO) Report to the Intelligence Oversight Board on NSA Activities - 
INFORMATION MEMORANDUM 

(U/ZKOUCTT Except as previously reported to you or the President, or otherwise stated in the 
enclosure, we have no reason to believe that intelligence activities of the National Security Agency during 
the quailcr ending 30 September 2012 were unlawful or contrary to Executive Order or Presidential 
Directive and thus should have been reported pursuant to Section 1.6(c) of Executive Order 12333. as 
amended. 

(U//^)UO) The Inspector General and the General Counsel continue to c.xcrcisc oversight of 
Agency activities by inspections, surveys, training, review of directives and guidelines, and advice and 


counsel. 




GEORGE ELl.ARD 
Inspector General 




RAJESH DE 
General Counsel 


(U/ii'OU(^7 I concur in the report of the Inspector General and the General Counsel and hereby 
make it oureombined report. 


KEmi B. ALEXANDER 
General. U. S. Army 
Director. NSA/Chief. CSS 

Enel: 

Quarterly Report 


This document mav be declassified and marked 


upon removal of enclosure{s) 




NSA on 12-19-2014. FOIA Case # 70809 
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I. (U) Intelligence, Counterintelligence, and Intelligence-Related Activities that 
Violated Law, Regulation, or Policy and Were Substantiated during the 
Quarter, as well as Actions Taken as a Result of the Violations 

LA. (U) Intelligence Activities Conducted under Executive Order (E.O.) 12333 
Authority 


I.A.1 (U) Unintentional Targeting or Database Queries against United 36-35 

Persons (USPs) or Foreign Persons in the United States (b)( 3 )-so use 3024 (i) 

(5//GI//ilCL TO USA. rVCYj During the first quarter of calendar year 2012 (CY20I2). 
the National Security Ageiicy/Central Secu rity Service (NSA/CSS) continued [ ] 

I ~| As part of that process, duplicate selectors were 

removed and the number of active selectors was reduced. At the end of third quarter of CY2012. 

NSA/CSS's primary tasking tools for telephone and Internet selectors contained approximately 
I lactive selectors. 

'-' (b)(3)-P.L. 86-36 

_(UVrOUO) During the third quarter ofCY2012. signals intelligence (SIGINT) analysts 

in i l instances inadvertently targeted communications to. from, or about USPs. while 
pursuing foreign intelligence tasking or performed a query using a USP selector. Unless 
otherwise specified, all intercepts, query results, and reports have been deleted or destroyed as 
required by United States SIGINT Directive SP0018. (d 


I.A.1.a. (U) Tasking Errors 


lb)(1) 

(b)(2) 

(b) (3)-50 use 3024(i) 


occurred I 


]weie erron eously targeted and collection occurred. The first collection error 
{because a collection operator I 


)nd error 


(b) (2) 

(b). (3)-50 use 


because a collection operator | 

All collected data has been purged. 


(b) (1) 

(b)(3)-P.L. 86-36 


NSA analysts discov ered that al_|had inadverteni 

occurred because the [ 
coordinate with SIGINT analysts! 

I I All results were deleted 

reports were issued. | 

the SIGINT analysis are now coordinating with| 


had inadvertently been tai^eted. T he error 

Id id not 


and no 


(3) (TS//51. ' , ' NF) I an NSA analyst was discovered t o have tasked a 

selector associated with a USP. The target, previously b elieved to be foreign. ] a 

USP who had been kidnapped in a foreign hostage case, j the selector was 

detasked and no reporting resulted. 


(b) (1) 

(b)(3)-P.L. 86-36 
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(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(4) (S//91//REL TO UGA. r\TV)[ 


selector for an e-mail account believed to be used bv a foreiaii taraetf 


it was discovered that a tasked 


was detasked 


J and no rqjorts were issued. 


The sel^lgi6H) 

* (b)(3)-P.L. 86-36 

(b)(3)-18USC 798 


(5) (ts//si/ i Tu:l to usa. r\TV) [ 


an 


Targeting of personnel ^ 


NSA analyst discover?^<'^-^°"""^°2^^') 

] 


jwas authorized as long as 
one end of the collection is outside the United States; however, upon further research, the analyst 
determined that both ends of the collection were in the United Slates, Non-compliant data was 
purged 


(6) (3//9I//RCL TO USA. rVCY) [ 


] an NSA analyst learned that 


unauthorized collection had occurred during a survey operation and training event because of a 
misunderstanding between NSA headquarters and an NSA field unit about activity approved. A 
request to disseminate collected data led to the discovery that unauth orized collection had 
occurred All e-mails containina the unauthorized data were deleted! I To 


) 

. ) 


:3)-p.L. 


avoid future occurrences, an approved Concept ofOperations for training and collection 
operations is required. 

86-36 

(7 KTS//5l/mGL TO USA. FVEYl l I duhna the test of a collection 

system, a developer inadvertently col lected data that included U.S. telephone numbers. The 
error occurred because the developer! 


]rH e developer deleted the collected data and 


I.A.1.b. (U) Database Queries 

(l)-H3 //b l ' ' RCL TO I’fj.A r\TV t 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i; 



(2) (U//TOU6i On j [ occasions during the third quarter, analysts performed overly 
broad or poorly constnicted data base queries that potenliallv sought or returned information 
about USPs. These queries us ed ~l 

I I that produced imprecise 

results On j [ of those occasions, the queries returned results, which were deleted or aged off. 
as required, and no reports were issued. Analysts who performed these queries were counseled 
by the ir management. 


(U) Procedural and other errors contributed to the following incidents: 


(b)(3)-P.L. 86-36 


(3//51//RCL TO UGA. FVEY) On! [occasions during the third quarter. NSA analysts 
performed queries in raw traffic databases without first conducting the necessary research 


(b) (1) 

(b)(3)-P.L. 


86-36 
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(b] ( 
(b) ( 


(b) (1) 
(b) (3) 
(b) (3) 


■(b) ( 
(b) ( 
(b) ( 


1 ) 

3)-P.L. 86-36 

on the selectors. When the queries returned results, they were deleted and no reports 
were issued. 


NSA 


(S/ ' /Sli ' /REL TO UOA. r\TY) During a routine database auditj_ 

database developers were discovered to have unknowingly run multiple queries in a 
database | 


Jwhile performing software testing on a new database, the 


developers ran the queries multiple times because software flaws prevented the queries 
from executing properly. No res ults were returned. To preven t future errors, the 


developers will test queries using 
-p.L. 86-36 beforehand. 

-50 use 3024(i) 


that have been verified 


(3) ' /31r/RPL TO USA. PVE1'[ 


a SIGINT analyst 

mistakenly ran queries in raw traffic databases on selectors associated with a USP 
because the analyst believed that the target, a USP. I 


llhe selectors weredetasked 


1 


reports were cancelled J l of them were reissued with the USP information 


masked. 




(b)(1) 

(b) (3)-P.L. 86-36 
a software developer vvas discovered to 


(S//S1//RCL TO USA. r\TY) | __ 

have performed aouerv in a raw traffic database using a query string that contained □ 

No results were returned by the query. The developer was 


counseled to be more careful when selecting text for testing. 


TOUfiA. rvCY) [ 


analyst had run a query in the incorrect raw SluINT database 




an NSA database auditor learned that an 

I The 


3) -p.L. 86-3&iiery was stopped before returning results. The analyst was counseled. 
3)-50 use 3024(i) 


(S//Sl//flEL TO USA. FVEV )[ 


an NSA database auditor discovered 


that, as the result of a software failure, a query was run in a raw traffic database against 


w query results were deleted. No reports were issued. 


^because of an error in the interface of a 


(6//6l//[\CL TO USA. fXTY) 
raw traffic database, an analyst performed a query that did not contain the e-mail address 
he had entered in the search field. As a result, the query returned a large number of 
results, which were deleted. The problem was reported to the database team to make 
changes to the interface to prevent future errors. 


(5//RCL TO USA. FVCYl T _ [ while conducting a lest, an NSA database 

developer unkno winuly execiited^^^nueries against SIGINT data. A software flaw 

altered the query [ Upon discovery of the software flaw, the 

query function was disabled until the software was updated to fix the problem.. (b) (l) 

(b) (3)-P.L. 86-36 


during a test[ 


(S'/Slz/IUIL TO USA. FVEY) ___ _ 

software tester unknow ingly performed I Iqueries against raw SIGINT. 
I [queries contained 


software, a 
Jrfthe 


A software flaw allowed the 
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.-"‘■(b) (1) 

(b) (3)-P.L. 86-36 


queries to be executed against raw SIGINT. The system automatically deleted the 
queries and results The software has been updated, and the flaw has been fixed. 


1S//S1//REL TO U3A. TVCW 
an NSA analyst learned thai 


taruet 


I 


1 after re turning from a month-long class, 
jassociated with a valid foreign 


emery resuTisT 


_^while the target was in the United States! 

I The selectoTThad been detasked I 

iThe analyst deleted the 


l and no reports were issued. The analyst was counseled to 
joefore extended absences from the office. 


(T5//S1//NF) 
queried on a selector associated 


;an NSA database au ditor disco vered that an analyst had 
with a U-S militarvl lin a raw traffic database on 


The query returned results, which were 
J The analyst’s database access was temporarily suspended. In 


deleted 

addition, the analyst was counseled on the proper querying techniques and instructed to 
retake intelligence oversight training, "(b) (i) 

(b) (3)-P.L. 86-36 

(TS/zs i /mcL TO ugj\. r¥i:Y) [ 


authorization on the selector associated with a 


~| an NSA analyst queried without 


The error occurred because the analyst believed that the selector was an alternate 
selector for a valid foreign target . The query returned results, which were deleted; no 


reports were issued. The analyst^ 
fiiture targeting. 


to prevent 


(TG//G I //Nr) [ 


an NSA analyst improperly performed a queiy on a 


selector authorized under a Foreign Intelligence Surveillance Court (FISC) Order in the 
incorrect raw traffic database. No results were returned by the query. The analy st was 
counseled to perform queries on FISC-authorized selectors I 


^approved databases. 


• (3//3I//REL TO US.A. ^ an NSA analyst discovered that a 

I Iquery of a valid foreign target I l in a raw SIGINT database when 

tlie target was kno wn to be in the United States. The analyd 

I I had detasked the t.u get’s e-mail selector f | me analyst 

and no results w ere returned: no reports were 
issued. I hhe analyst was counseled I I 


. 86-36 

• (TS//5h/Nr) | I an NSA analyst performed I l oueries on a U. S. 

organization in a raw traffic diabase without formal authorization because the analyst 
incorrectly believed that he was authorized to query due to a potential threat. No results 
were returned by the query. The analyst was counseled that targeting or querying USPs 
was not permitted without formal authorization. 
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(S//S t //REL TO USA. rVCY[ 


] a SIGINT analyst inadvertently q ueried 


on a U S. telephone selector in a raw traffic database. The analyst deleted the query 
I No results were returned by the query 


Tnii'^4 

7¥YT 



^ ; j 

iisin$ 

;_^_selectoMhat^^ 


a SIGINT analyst performed a query in 
associated with a USP. The taruetinj> 

before querying The analyst halted the query before it returned any results. 

(S//S li VP , EL TO USA. FVCY) | 


after copying several selectors into a 


(b)(1) 

(b)(3)-P.L. 86-36 


query in a raw traffic database, a SIGINT analyst realized that one of the selectors was 
associated with a USP. Upon realizing the error, the analyst deleted the query, h^)(i) 
results were returned by the query. (b)(3)-P.L. 86-36 

(b)(3)-50 use 3024(i) 

- (Tn//r>i//NF t l I an NSA analyst performed a query in a raw traffic 

databa se tisini’ a selector as sociated with a USP. The analyst deleted the query and 
results i l and no reports were issued. The analyst was reminded that 

querying on USP selectors without authorization is prohibited and that query results 
returned by the unauthorized query must be deleted. 


(S//GI//RTL TO USA. rVCV) [ 


an NSA analyst discovered that a 


software flaw had allowed a query ] 

I I Upon discovering that the query returned a larger 

number of results than expected, the analyst canceled the query and deleted the results 
without viewing them. The analyst reported the software problem to the database 
developers to develop a patch. (b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


( TS//S I //N ^ 


a SIGINT analyst performed without proper 


authorization a query in a raw SIGINT database on a selector associated with a USP. 
While trvinu to verify the status ofthe taraet. the analyst queried the raw traffic database 

-_--- I 


To avoid future errors.^ 


No results were returned. 


(9//9I//RCL TO UOA. r\TV) [ 


NSA analysts performed i b ueries in raw traffic databases on selectors associated with 
valid foreign targets that included the dates when the targets were known to be in the 
United States. 


were issued. 


queries returned results, which were deleted; no rqjoils.. 


(b)(1) 

(b)(3)-P.L. 86-36 


(T3//3I//NF t[ 


selector that had been determined to be a USP. 


J SIGINT analyst ran a query on a previously detasked 


he query returned results, winch were 


deleted 


T OP SkLRt T /jmTALEyT KCYiiOLEmOrORN 
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(TS//31//tJr) [ 


anNSA analyst performed a query on a selector 


associated with a USP that contained a date range not covered by the approved _ 

consensual co lleaion agreement. The analyst included the peri(^ o fl I 

instead of the intended period ofl_ I The error 


(b)(3)-P,L: 66-36 


occurred becaus e the analyst believed that the d ataba*^ 
I I The query results were deleted^ 


issued. 


and no reports were 


(G//G1//RCL TO L ' 3A. FV'E'i' ) ! _| anNSA database auditor discovered 

that an analy st had performed | [ queries in a raw traffic database without f 


believed that [ 


to exclude USP data. The error occurred because the analyst incorrectly 


The analyst dele ted the queiv result s [ 


advised the analyst to ensure that| 
the interface before querying. 


I The audit^ 
had been implemented properly by 


(S//SI//PlEL to USA. r\TY) 


an analyst conducted a query that 


contained selectors associated with i I taruets in the United States. Non-compliant data 
was deleted, and the analyst was counseled on proper query procedures. 


(S//GI//RCL TO USA. rVCV) [ 


(b)(1) 

(b)(3)-P.L. 86-36 a query in a raw SIGINT database! 
(b)(3)-50 use 3024(i) ‘- 


an NSA analyst mistakenly performed 
No results were returned. 


(3// 3 l //[lt: L TO UOA. r\T^ ) | 

tluitl Iqueries had been conducted in a raw SIGINT database 


an NSA database auditor discovered 


The analyst was counseled. No reporting or dissemination resulted 


(TS//SI//MF) 


an NSA analyst mistakenly queried in a raw traffic 


database on the selector associated with a USP. Upon realizing the error, the analyst 
deleted the query results. No dissemination occurred. (b) (i) 

_ (b){3)-P.L. 86-36 

( S/ZS I /ZREL TO U5A. TVCY) | an NSA analyst queried on his own 

personal identifier in a raw traflic database because the analyst was unfamiliar with the 
database interface and was not aware that he was searching against raw traffic. The 
analyst was provided training on proper querying techniques. 


(S//aCL TO UGA. rvcv ) 


an NSA database auditor discovered that 


an analyst had queried in a raw traffic database on 


~| were accidentally included among the seaich terms in the query, 
he analyst was counseled. No results were returned, and no reports were issued. 


• (S/'Sl/'PtEL TO USj\. rVCY) | | an analyst queried on j I selectors 

associated with a foreign intelligence target known to be in the United States because the 
analyst entered an incorrect date range for the query. The analyst was counseled. and the 
results were deleted. 

(b)(1) 

(b)(3)-P.L. 86-36 
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(S/ZSIZ/REL TO USA. FVCV) |_| an NSA dati 

discovered tha t an analyst had queried in a raw traffic database on 
I I The query returned no results 


(S//Sl/ i T\.EL TO UGA. rVCY) | [ while responding to a request for 

information, an analyst queried ^ k ^w traffic databases on a selector associated with 
a foreign intelligence target while the taraet was in the United States. The reque ster did 
not include in the request inforination | the United States. | | 

j the analyst deleted results returned by queries, and no reports were 

issued. 


• (3//9l//RnL TO USA. FVIIY)|_ | an NSA analyst l earned that a 

.selecto r on which he had performed queries hCir raw traffic databases ) | 

(b)(3)-P:L. 86-36 I vas associated with a USP. The queries and results were deleted. No reports were 

issued. 

• (TG//GI//>fF) [ I an NSA analyst queried without appropriate FISA 

authori zation on an untamed selector asso ciated with | 

\ I Although ar j I FISC Order exists, neither the target nor the 

selector was included in the order. I I the analyst was counseled on 

the restrictions for querying on selectors not authorized under FISA authority. No reports 
(b)(3)-P.L. 86-36 were issued. 

(b)(3)-50 use 3024(i) 

• (S//3I/ /REL TO USA. FVEYtf ( after discovering the foreign 

target'^ |the United States, an NSA analyst continued to perform a 

query in a raw traiiic aataoase to determine whether the target was in the United States. 
The analyst was counseled about reN iewinu selectors and promptly detasking them after 


• tS i' /SI/ZRCL TO USA. rvCY) l I a SIGINT analyst queried | | 

selectors associate d with a foreign intelligen ce target when the target was known to be in 
the United States. \ [ the anal yst requested detasking of all 

(b)(3)-P.L. 86-36 selectors. The analyst deleted the query and results | 

• (S/ZS I Z/REL TO USA. FVEY) | an NSA analyst mistakenly 

perfo rmed a query in the incorrect raw traffic database using selectors associated with a 

(b)(1) ,»SP| 

(b)(3)-P.L. 86-36 I 

(b)(3)-50 use 3024( ^ | Upon discovery of the error, the analyst stopped the 

query and deleted all query results. No dissemination occurred. 

• (5//Gl'''RCL TO USA. FVE¥ )j | NSA an alysts discovered that 

I I on selectors for foreign 

intelligence taraets while the taraets were in the United States because queries_ 

^ ~ I 

| ihe analysts 

canceled the queries and deleted the results; no reports were issued. To prevent future 


(b)(1) 

(b)(3)-P.L. 86-36 
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error, a new procedure was developed 


■ '(m) 

(bj(3)-P.L. 86-36 




anNSA analyst discovered fhat[ 


Jon a selector associated with a FISA-approved target had 


continued to ran beyond the period of the FISC Order. The error occurred because the 
analyst, who was unfamiliar with the database. 


No reports were issued. 


]and deleted the resultsj^ 


( S/fSl ' iRCL TO UOA. rv[:Y) [ 


[ while conducting a test, an 

NSA database developer performed queries i n a raw traffic database on selectors that 

The query results were not stored. (b)(1) 

- (b)(3)-P.L. 86-36 

I.A.I.C. (U) Detasking Delays (b)(3)-50use3024{i) 


(1) (O/ZOl'iRCL TOL’fiA. 


an NSA analyst discovered that the 


selectors associated with j | valid foreign targets had remained on task when the targets were in 


the United States. The error occurred because the analyst had overlooked information 


the analyst detasked the selectors. No reports were issued 


(b)(1). 

(b)(3)-P,L. 


(2) (S//61//REL TO USA. F¥EY)[ 


anNSA analyst discovered that| | 


:S-a£_- ^ ^ • 'I_I.. ^ - 

J [associated with a valid foreign target had remained on task when the target was in the 


United States 


J because the analyst was away from 


the office for long-term training, the analyst was advised to detask selectors before extended 
absences from the office. 


(3) (Q/ZQI/ZRCL TO USA. rVCY{ 


an NSA analyst discovered that a 


selector associated with a valid foreign target had remained on task while the target was in t he 
United States because the I - - — . . ^ 


the selector was detasked and the results were 


deleted No reports were issued. The analyst was counseled on immediate detasking procedures. 


(4) (S i VSl/,TUiL TO USA. F>^EY) [ 


] an analyst discovered that selectors 


associated with a valid foreign intelligence target had remained on task while the target was in 
the United States. T 


[ 


] The selectors were detasked^ 


has been purged, and no reports were issued. 


Non-compliant data 


(5) (0//01//RCL TO UOA. rVCV) [ 


the selectors associated with a 




foreign target remained on task when the target entered the United States on 
delay occurred because an Intelligence Community agency analyst did not 


/. 


reports were issued. 


The 


The NSA analyst detasked the selectors [ 


(b)(1) 

(b)(3)-P.L. 86-36 
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I an NSA analyst discovered that 
associated with a valid foreign target, even 


collection had occurred |_ jassociated with a valid foreign target, even 

thoii.i^h the selectors had been detasked | | 

I The collec tion was attributed to a processing error ] 

|tha i resulted in the deta^ request not being processed 
~| the selector was detasked and non-complianf data was purgea. ino repons 


were issued. 


...(b)(1) 


(b)(3)-P.L. 86-36 

_ (Tug /'-SI 'REL TO USA. FVEV f | an NSA analyst discovered that 

“p ssociated with a valid foreign ta rget had re mained on task after the target had 
entered the United St ates on j I The analv st | | 

[after learning | [ hat the taruet was in the United States but 

[ selector 

was detasked. No data was collected. 


(8) (Q//S1//IICL TO USA. FVE'i') [ [ selectors associated with a 

valid foreign target were d iscovered to have remained on task while the target was in the United 
States , r I the analyst [ 

I [ another analyst discovered ! 

land detasked them The results were delet^. and no reports were issued. 


(9) (S//S1/)TICL TO USA. FVEY) ! l after discoveri ng that a valid 

foreign target[ [the Unit ed States, an NSA analyst detasked] 

~| another analyst discovered! 

[ No non -compl iant data was collected, and no reports were issued, t he analyst 
was counseled to check I Iselectors associated with a target when detaskine. 


(lO) (S/ZSimEL TO USA. FVEY) An NSA analyst discovered thatj_| ' 

associated with a valid foreign target had remained on task when the target was in the United 
States from I I 

[the analyst had faile d to detask this selector The analyst deleted the 
collection associated[ [No reports were issued. 


(b)(1) 

(b)(3)-P.L, 86-36 



'.L. 86-36 
8 use 798 
D use 3024(0 


_ (12) (3//S1/;^L TOU&A. rVEV ' ) | | an NSA analyst discovered that 

I_[selectors associated with a valid foreign target had remained on task while the target was in 

the Unite d States I [ after learning that t he target had traveled to the United 

States on [ the analyst detasked selectois P which remained on 

task until j Conftision about whether the data required purging resulted in a delay in 


(b)(1) 

(b)(3)-P.L. 86-36 


9 





DOCID: 4165219 

TOP SEVRET)m/)rAI.EST KEYHOlEmVFORN 


purging. The analyst submitted a purge request for non-compliant data 
reports were issued. 


No 


(13) (S//31//REL TO USA. FVEV )[ 


>..- -. - - . . an NSA analyst discovered that 

I [ selectors associated with a valid foreign target had remained on task while the ta rget wa s in 
the United States.) ^nd detaskingl | 

associated selectors I | the analyst learned that | 


were detasked. No non-compliant data was collected, and no reports were issued. 


_^electors 


(14) (S//S1//RCL TO USA. FVEY) [ 


(b)(1) 


an NSA analyst discovered 


that one selector associated with a valid foreign target had rem ained on task while the tar get was 
in the United States. The analyst first became aware the target |the 

United States I I After conducting further research, the 


an alyst found that theta ruet's e-mail selector was still tasked. The analyst detasked the selector 


on 


and no reports were issued. 


(15) (G/ZGInRCL TO UDA. HTY) 


]nSA analysts 


discovered that | | selectors associated with) [valid foreign t argets had remained on task 

while the targets were in the United States. ] j detask request of the selectors 

the United States, collection occurred on the s electors. Upon . 

discovery of the collection, the analysts detasked the selectors and deleted] j (b)(3)-P.L. 86-36 


(16) (OnGln'RIIL TOUOA. TVCY) 


selectors associated with 


a valid foreign target were discovered to have remained on task while the target was in the 
United States The delay occurred because the analyst mistakenly believed that! 


the 


selector was detasked. No reports were issued. The analyst was counseled 


(17) (S ISII P.CL TOIjy.’ii. F\'TV)[ 


an NSA analyst discovered 


that a selector associated with a valid foreign target had remained on task while the target was in 


the United States. Although^ 


Jthe target's selectors remained ontaskL 


The delay occurred because the analysts responsib le for tasking were on leave or temporary duty 

] No reports were issued. .(b)(1) 

-(b)(3)-P.L. 86-36 

(18) (TS//Sl//NP)j I NSA analysis discovered that collection 

l occurred on select ors associated with valid foreign targets 
detask that had been requested ^ 


despite! 


in the United States. The error occurred becausej^ 


not aware of the detask requests. All non-compliant data was deleted, and no reports were 
issued. 


hvas 


(19) (S/ZSl/.^REL TO USA. TVEY) 


that] Iseleciois 


an NSA analyst discovered 


lad remained on task after the expiration of a consensual collection request on 
The delay in delating occurred because the analyst was not aware that the 
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I The selectors were detasked 


No collection on these selectors occurred 
(20) (TS//SI/)T*IFi 


I an NSA analyst discovered that l I selectors .. .■ 
associated wi th |__|valid foreign targets had remained on task while the targets were in the / hw^\-p l 86-36 
United States! I' 


selectors were detasked 
reports were issued. 


was notified about the selectors that were to be detasked. and all 

No collection resulted from the selectors, and no 

(b)(1) 



I.A.3 (U) Unauthorized Access 


(1) (5// ' gi//RCL TO U9A. rVCY) [ 


two analysts accessed raw SIGINT 


from a location not approved for that access, 
only from approved locations. 


(2) (S//SI//REL TO USA. F\TIY)[ 

dia 


The analysts were counseled to access raw SIGINT 

(b)(1) 

(b) (3)-P.L. 86-36 
raw SIGINT data was stored in 


files accessible to NSA personnel who did not have the appropriate training and were not 
authorized to view the data. The data was moved to files for which all personnel with access had 
the required training. 


I.A.4 (U) Data-Handling Error 


(1) (S//PJL TO USA. r\T:¥ f On six occasions 


NSA 


analysts disseminated raw SIGINT in e-mails to 1C agency analysts and other external customers 
not authorized to receive the information. The e-mails were deleted, and ail analysis were 
counseled. 


(2) (T9//3IWJF ) r 


(bKl) 


ttW)-P L. 86-36 
(b)(3)-50 use 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(3) (O/iTlEL TO USA. rMIY) [ 


an NSA analyst passed raw SIGINT data 


to a database without minimizina the U S. identities The data was recalled 


NSA personnel revealed the 


names of USPs to individuals not authorized to receive the information. They were counseled on 
procedures for disseminating USP identities 


"fcl) ,-, 

(b) (3)-p.L. 86-36(5) (G//RCL TO U3A. rVCY l I NSA analysts disseminated 

raw SIGINT in an e-mail to recipients not authorized to receive the information becau se analyst s 
used an incorr ect alias that included the name s of analysts from exte rnal organizations. ! ~| 

I the analyst recalled the e-mails. I ~| the analyst sent a follow-up 

e-mail to inform recipients to delete the e-mail. 


(6) ffG//01/iT'(F) r ^ in response to a request for information, an NSA 

analyst disseminated in an e-ma il to an 1C customer not authorized to see the information a 
selector associated with a USP. j | the analyst requested that the e-mail be 

deleted. The analyst was counseled on proper minimization procedures. 


I.B. (U) Foreign Intelligence Surveillance Act (FISA) 
I.B.1. (U) NSA/CSS Title I FISA 


I.B.I.a. (U) Detasking Delays 


(TS//S I //NF ) ! I an NSA analyst discovered that a telephone selector 

associated with a valid foreign targ et had not been detaskedi 


Although 


[ 


j the analyst responsible f or the telephone selecto r had failed to submi t a request 
for detasking Th e selector was detasked | 1 and data was purged 

I No reports were issued. 


I.B.I.b. (U) Unauthorized Targeting 


(b)(1) 

(b)(3)-P.L. 86-36 


(1) (TG//Gl//I ‘ Jr) [ 


j ail communication s collected on these selectors were 
requested to be purged. No reports were issued. 

(2) (TS//SI/^i 


■(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 
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'(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 


(b)(1) 

(b)(3)-P.L. 86-36 (3) (TQ//ai/;?Jr) [ 


an NSA analyst discovered that collection had 


occurred on a taiuet authorized under a FISC Order before the approved date[ 



Non-coinpliaiu data vvasdeleted[ 


and no reports were issued. 


NSA has taken steps to ensure that operational plans are properly reviewed and approved. 


(4) (TS//SI//Nr) 


an NSA analyst discovered that a selector 


associated w ith a valid Foreign tai-jet had remained tasked after the target had departed the 
United Stated 

I I the analyst detasked the selectors and 

submitted a purge request for the collected data. No report s were issued. To prevent future 
occurrences. ensure that selectors of targets 

departing the United States are detasked timely. 

I.B.1.C. (U) Unauthorized Retention 


(TO/yGI/ i ND 


_^an NSA analyst discovered that data collected under ! I 

ISA authorizations had been retained in a raw traffic database longer than 


( 1 ) 


the authorized retention period. The data was purged, and no reports were issued. The analyst 
was counseled on retention procedures. (b)( 1 ) 

(b)(3)-P.L. 86-36 

I.B.I.d. (U) Unauthorized Access (bX3)-50 use 3024(i) 


(b)(3)-P.L. 86-3 i^TS//S]/yi>jr) 


analysts were allowed to retrieve da ta collected 
they were not authorized to access. 


5 


Ibec ause of a raw traffic databa se error. I j SIGINT 

' ' FISA authority that 


he problem will be fixed in a ftiture software update 


I.B.I.e. (U) Data-Handling Errors 

(1) (13'. ' 'RI:L TO I'SA. 


a Branch Chief discovered that, because 
JFISA data had been disseminated improperly in an 


e-mail to a distribution list that contained the names of two individuals not authorized to receive 
the information. The e-mails were recalled, and the analyst was counseled on proper 
classification markings. 


(2) (S/ZREL TO U3A. FVTY) 
for access to FISA data recovered a F 


an NSA contractor not authorized 


IS.A document from a printer in a contractor SCIF not 
authorized for FISA data. Another contractor, who was authorized for FISA data, had printed 
the document four times because he believed that the printing had been unsuccessful. The copies 


TOP SCCRET/^'SI//TALE.\T KEYIWLEmOFOIVs' 

13 




DOCID: 4165219 

TOP SECRETmMTAlENT KEYHOf E/ZNOFORN 


remained on the printer until they were discovered by the contractor. A second contractor, who 
also believed that printing had been unsuccessful, forwarded the document in an e-mail to a third 
contractor. All copies ofthe document were retrieved and destroyed. 


I.B.2. (O/ZREL TOUOA. rV E¥-l 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


I.B.2.a. (U) Data-Handling Error 


(S .i' S I'' PiEL ' TO Ufi.V. F\ 




an NSA analyst forwarded | | 


I I information in a n e-mail to analyst no longer authorized to receive the information. 


the NSA analyst confirmed that the e-mail had been deleted. 


I.B.3.-(TSffSt//NFT Business Records Order 


(U) Nothing to report. 

I.B.4. (U) FISA Amendments Act(FAA) 
I.B.4.a. (U) FAA Section 702 


(b)(1) 

(b){3)-P.L. 86-36 


(b)(3)-P.L. 86-36 


has implemented a new process to ensure th at FAA v?702 data 
required to be piiri^ed is purued from NSA'CSS databases. NSA created al I 


compliant data that should be purged. 

I.B.4.a.i. (U) Tasking Errors 


to identity non- 


(1) (T0nG I .’,Ri:L TOUOA. rVE ' Vf 


an NSA analyst discovered that a 


selector had been tasked in error. An 1C analyst had made a typ ographical error in the selector 
and passed the incorrect selector for tasking to the NSA analyst. | | the analyst 


detasked the incorrect selector and submitted the correct selector for tasking. No collection 
occurred. 


(2) (T6//S1//REL TOUGA. r\TY) [ 


were incorrectly tasked because of typographical errors. The selectors were detasked. and the 
information has been purged. No reports were issued. 


, .. (b)(1) 

]selectoi«3)(3)-P.L. 86-36 


(3) (TG//G1//REL TO USA. rVC'l' j] 


an NSA analyst discovered that □ 


selectors had been improperly tasked because there was insufficient information to verify that the 
targets were l ocated outside the United States. Additional information was provided to c orrect 
the tasking o j I Non- 

compliant data collected on the _ selectors has been purged. 


(4) (TG//GI//RCL TO UGA. rVCV) [ 


an NSA analyst discovered that a 


selector had been tasked in error because the target did not meet the criteria of the FAA §702 
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certification 


and no reports were issued. 


the selector was detasked. Non-compliant data has been purged. 


(5) (TS/ZSimCL TOUSjX. FVCY) [ 


an NSA analyst discovered that an 


e-mail selector for a valid foreign target had been tasked incorrectly because the e-mail address 

I The incorrect selector was associated with a USP It was 

detasked. and non-compliant data was pursed. No reports were issued. (b)(1) 

(b)(3)-P.L. 86-36 

(6) (TS//3I//REL TO USA. FVEY) | t an NSA analyst discovered that a 

selector for a valid foreign target had been tasked incorrectly. An IC agency analyst mistakenly 
believed that I 


[ 


J The incorrect selector was determined to be associated with a USP and was 


detasked Non-compliant data has been purged, and no reports were issued. 


(7) (T3//31//RCL TO U9A. FVCV) | | an NSA analyst discovered that a 

foreign target’s selector had been improperly tasked unde r FAA ^702 becau se targeting 
procedures were not followed. The selector was detasked T [because of the 


target’s travel to the United States; 


(b)(1) 

T)){3)-P.L. 86-36 


Die selector was detasked 
Non-compliant data has been purged, and no reports were issued. 


I 


(8) (Sy/S i y/REL TO USA. FVCY) [ 


] an NSA analyst discovered that a 


selecto r associated with a valid foreign intelligence target had been improperly approved for 
taskingl 


The selector was detasked 


No collection occurred. 




■(b)(1) 


an NSA analyst learned thatj |selectors for a (b)(3)-P.L. 86-36 
foreign target had been erroneously tasked because] j 


I not authorized under the FAA J702 certification. Upon recognition of the error, the 
analyst detasked the selectors. No collection occurred. 


(10) (TaVSLVRCL TOUGA. r¥CY) [ 


a selector had been improperly tasked under FAA ^702 authority 
targeting procedures had not b een followed. | 
and two reports were canceled. | 


2 


an NSA analyst learned that 

Jbecause .'(b)(1) 


the selector was detasked (b)(3)-P-l-. 86-36 


it was learned that data collected on this 


selector remained on a dual-route to an 1C customer. 


[ 


Non-compliant data collected 


purged. 


Jias been 




an NSA analyst discovered 


that a selector associated with a foreign target had been tasked incorrectly. The selector was 
detasked. and non-compliant data has been purged. No reports were issued. 


I.6.4.a.ii. (U) Database Queries 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


tb) <3) 


■(b)(1) 

(b)(3)-P.L. 


(I) (TS//SI/ i l?tEL TCD - USA. r\TY) On [occasions in the tliird quarter, analysts 
performed in FAA $702 data collection overly broad or poorly constructed dat abase queries that 
potentially targeted and returned information about DSPs. These queries usedi I 


r 


•p 


[produced imprecise results. On| |ofthose occasions, thequeries 
returned results trom the database. The results were deleted or aged off. as required, and no 
reports were issued. Analysts who performed these queries were counseled by their 
management. 

,L. 86-36 

(2)fF 9//0l//IU:L TO USA. nTY) [ 


traffic database l I queries on a selector associated with a USP 
were deleted. No reports were issued. 


Jan NSA analyst performed in a raw 


the results 


(3)^T0//0I//Mr^ On | l occaslons 


NSA analysts 

improperly queried on the selectors associated with FAA $704/70.>( b) USP targets in FAA $702 
law traffic databases. 


The analysts were counseled on the procedures for querying on 


FAA $704/705{b) targets in raw traffic databases. The queries and results were deleted. 


86-36 


an NSA database auditor discovered that an analyst 
had performed an improper query in a raw traffic database. While conductiny research on the 


selector before queryintt. the analyst noted that the target’s e-mail acco unt ■ _ 

l Althouah aware that OCX 


approsal was required for 


!' 


the analyst missed that information while conducting 


(51 (S//SI//REL TO U S A. rVCV) 1 I an insa analyst mistaKeniy_toni; 

performed a query in a raw tr affic database or j S electors that had been detasked because f | (b)(3)-P-L. 86-36 

|ihe United States. The analyst intended to check the tasking tool 
but queried the raw traffic database instead. The selectors were detasked [ 
and non-compliant data has been purged. No reports were issued. 


an NSA analyst mistakenly (b)(1) 


(6) (G//G1//IIEL TO USA. rVCY) [ 


an NSA analyst discovered 
that a selector associated with a valid foreign intelligence target remained on task after the target 
had arrived in the United States. While conducting research on the selector, the analyst 
perfor med a query in a raw traffi c database when the target was known to be in the United 
States. I | the selector was detasked. Non-compliant data was purged, and 

no reports were issued. 


I.B.4.a.iii. (U) Detasking Delays 


(i)-(TS/.^si/i^ir) 


an NSA analyst detas kedj 


associated with a tarset who had entered the United States, but 


(b)(1) 

-^3)-P.L. 86-36 


The selectors were detasked. and non-compliant data has been purged. 
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(2) (S//S1//REL TO USA. rVTY) | | a selector associated with a valid 

foreign intelligenc e target was discovered to have remained on task after the target h ad arrived in 
the United States. | [the analyst 

made a typographical error in the detask request and the selector remained on task ) 

I I All non-coinpliantdata has been pursed, and no reports were issued 
'-' __ "\b)(1) 

(3) (SZ/Sl/iUCL TO USA. FVCY) | 1 an NSA analyst reported that a (t')(3)-P.L. 86-36 

selector associated with a valid foreign intelligence tarset had remained on task after the target 

had arrived in the United States. I | 

□□ the analyst had failed to detask the selector. The selector was detasked | | 

and non-compliant data has been purged. No reports were issued 

(4) (9//SI//RCL TO USA. FV E V) | | an NSA analyst discovered that ) | 

I [ selecto rs associated with a foreisn target remained on task after the tarset had entered the 

United States. I I 

[ the selector was confirmed to have been detasked. and non- 
compliant data has been purged. No reports were issued. 

(5) (S , VS[//REL TO USj\. F\fDY) | | an NSA analyst discovered lhat | | 

selectors associated with a valid foreign intelligence target remained on task after the target had 
arrived in the United States I - 


the selectors were 


letasked. and non-coinpliant data has been purgt 


Jo reports were issued. 


(b)(1) 

(b)(3)-P,L. 86-36 


(6) (S//SI//PiEL TO USA. FVEYl l I a selector for a valid foreign target 

was c iscovered to have been overlooked when i 

I because of the target's arrival in the United States. The selector was detasked ]^^^^^" 

_ Non-compliant data has been purged, and no reports were issued. 

(7) tfS/ZSIZ/ft H" I an NSA analyst learned th at a selector had rem ained 

on task even tho ugh it had been determined that the target was a USP. | l lhe 

analyst detasked p | . The 

selector was detasked! I No collection occurred, and no reports were iss^^l „ 


---- --1_I--..(b)(3)-P.L. 86-36 

_ I-1 (b)(3)-18 use 798 

(8)4TS//Sh^MEj[. _ I an NSA analyst discovered that | |sglect^3i-50 U SC 3024(i) 

associated with a valid foreign intelligence target remained on task after the target ! ~| 

The detask delay occurred because the analyst w as out of the office and there 
was no back-up ! I the analyst confirmed that the 

selectors were detasked. and non-compliant data has been purged. 


(b)(3)-P.L. 86-36 


/S1//RCL TO USA. rVCV) r ' | an analyst failed to tim ely deta sk 

; associated with valid foreign targets, which were in the United States. | | 

the selectors were detasked. No collection occurred. 


(10) (S//S1//RCL TOU9A. FVEV) | I an NSA analyst discovered that a 

selecto r associated with a foreign target had remained on task when the target was i n the United 
States. I |the analyst 



(b)(1) 

(b)(3)-P.L. 86-36 
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did not detask i | the United States ] [ the selector 

was detasked. and non-compliant data has been purged. No rqjorts were issued 


(11) (TS//S[//^J^) | I selectors associated with a valid foreign • 

intelligence taruet were disc(;i \’ered to have remained on task 

Because of an oversight, the analyst did not see the request to 
detask all selectors associated wi th the taruet because the target was in the United States. The 
alternate selectors were detasked f and non-compliant data has been purged. 

No reports were issued. 


(b)(1) 

(b)(3)-P.L. 86-36 


(12) (G//GIiVRE:L TOUOA. rVC ¥)-AnNSA analyst failed to det ask selectors associated 
with two foreign targets known to be traveli ng in the United States from | 

The selectors for both targets were detasked_and non-compliant data has 

been purged. 


(13) (S//S1/;RCL TO USA. FVCY) |_| an NSA analyst discover ed 

that a selector for a valid foreign target had be en tasked incorrectlv l I (b)(1) 

I I No collection occurred. The selector was 


(b)(3)-18USC 798 
(b)(3)-50 use 3024(i) 


(14) (TS//S1//R.CL TO USA. rVCY ) | | an NSA analyst discovered 

that a selector associated with a foreign target had remained on task when the target entered the 
United States. Although detasking had been requested] |the 

analyst had overlooked detasking the selector.] ] the selector was detasked. 

and non-compliant data has been purged. No reports were issued. 


(b)(3)-P,L. 86.3 6 (151 

that^ 


//S1//RCL TO USA. FVGY)L _| an NSA a nalyst discovered 

selector associated with a valid foreign target remained on task] j 


analyst detasked the t elephone selector after learning that the target ) 

I ~ While conducting ftirther research on the selector, the a nalyst also 

discovered that the target was a USP The delay in detasking occurred because) 


The selector was detaskec 


and all non-compliant data has been purged. 


miscommunication between a nalystsj _ ^lectors associated wi 

remained on task eyen though ^ 

khe United States. The delay in detasking occurred because 


_) be cause of a 

lectors associated with) )valid foreign targets 


( that the targets ha d 

entered the United States. The analysts were counseled to conduct thorough research to find □ 
Iselectors associated with the targets and detask accordingly. Non-compliant data has 


een purged. 


(b)(1) 

(b)(3)-P.L. 86-36 


An NSA analyst failed to detask I 


selector 


associate d with a foreign t arget even though 
Ithe United States] 


The error occurred because] 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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detasked the selector 


reports were issued. To prevent future errors.[ 


I The analyst 
Non-compliant data has been purged, and no 


and require that a second analyst review the selectors. 


^b)(1) 

(b)(3)-P.L. 86-36 
Jan NSA analyst discov ered 


(18) (S.| ySh/REL TQUSA. F\^Y) | ' ~ _ __^_ 

that ihj Iseiector associated vNith a valid forekn tariiet remaine d on task even tlioiighl | 

^_ Ibecause the taruet had 

entered the United States. The error occurred because l I 

I was not shared with the analyst Non-compliant data has been purged, and no 
reports were issued. To prevent future errors.[~ [will be sent to multiple analysts. 


I.B.4.a.iv. (U) Data-Handling Errors 


(1) KLL 10 U!!lA. 1'MM[ 


after completing an 10 training 


course, an NSA analyst realized that he had disseminated FAA $702 data in an e-mail to three 
analysts not authorized to receive the data. All e-mails were deleted] | 


TO USA. F\'EY) | it was discovered that an NSA 

analyst had diss eminated FAA §702 raw data by posting tiie data on internal NSA web pages in 
laccessible to an alysts not authorized to receive the data. The non-compliant data 
was removed | land a request was submitted to remove the web pages. 


(3) (0//01//R.CL TO USA. F^T^^ )[ 


an analyst forwarded FAA data to a 
group e-mail address containing personnel not authorized to receive the data. The error occurred 
because th e e-mail classificati on tool changed the classification to remove the restriction for 
FAA data ! I the e-mail was recalled. 


(4)t»‘ / St //REh TeUSA: FVE¥) i [ an NSA database developer 

forwarded a file containing FAA §702 data to another developer who was not authorized to 
receive it. Upon realizing that the file contained FAA §702 data, the developer deleted the data 
from his mailbox. All members of the development team have since received the briefings on,, 
handling FAA §702 data. (b)(1) 


(b)(3)-P.L. 86-36 


(5) (0//G[//riCL TO UOA. rvcv) [ 


an NSA analyst disseminated 
FAA §702 data in an e-mail to another analyst who was not authorized to receive the 
information. The second analyst saved the data in a file in the home directory, which is not 
approved to store this type of data. The e-mail and file were deleted. 


<6) fWr i l//REL TOUPA FVCYf 


an NSA analyst reported that in 
jhe had forwarded FAA §702 data to a forward-deployed coworker not authorized to 
receive the data. The analyst delayed reporting the incident for fear that the coworker would be 
removed from the deployment. The analyst was counseled on the methods to check clearances 
before sharina raw SIGINT data. 


^ _| an NSA division manager discovered that notes 

based on | | had been 

shared with ] ^ analyst not authorized to receive the data. The error was attributed to a lack 
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of a stand ardized p rocess for sharing informal working notes and the provision of an NSA e-mail 
account t o| [ analyst who was not operating under SIGINT authorities. The manager 

informed | janalyst that the notes must be deleted and had the analyst removed from the e- 


mail alias for notes. 


(8) (S//G1ATICL TQUGA. r\TY) [ 


an analyst unknowingly forwarded 
FAA ^702 data to a u roup e-mail address containing personnel not authorized to receive the data. 

data was removed from the servers and the analyst was counseled on the 


(b)(1) 


appropriate alias to use. 
I.B,4.a.v. (U) Overcollection 


(1) (T0/)'D1/)TUIL TO USA. r\'EY) 


(b)(3)-P-L. collection. NSA personnel discovered tnal| 


Idurinu areuular review ofE.O. 



NSA has deployed a 

short-term solution to address tlie problem and is continuing work on a long-term solution. See 
the summary of the Congressional Notification on page 23. 

(2)-ff S/ i fSl i mEL TQUGA. rVCV) | 


that r 


NSA collection managers learned 


been marked tor purging. Work on a resolution to the problem is ongoing. 
I.B,4.b. (U) FAA Section 704 
I.B.4.b.i. (U) Data Handling Errors 

(TS" ' fi M4Bl lii was discovered that.l 


Non-compliant data has 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


I Apurge was requestedf 

]W data flow error has been corrected to prevent future incidents. 


P 


I.B.4.b.ii. (U) Database Query Errors 


(b)(1) 

(b)(3)-P.L. 86-36 


(TS SI 'MP{ 


^an NSA analyst discovered that another analyst had 
performed a query in a raw traffic database l H The 

analyst discovered the error when the original query was amended | and he 

notice d a significant decreas e in the number of results. The analyst deleted the query and the 
resu 1 1 s | ~| 

I.B.4X. (U) FAA Section 705(b) 

I.B.4.c.i. (U) Data-Handling Errors 
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(S''"SI""REL TO USA. FVEY) Oil] [occasionsl i 

SIGINT operator posted | on selectors authorized under FISA ^70o(b) into a chat room 

that was not approved for FISA data. Upon realizing the mistake, the analyst posted a message 


requesting that all notes and recordsj 
I.B.4.c.ii. (U) Tasking Error 
I.B.4.c.iii. (U) Detasking Delay 


be deleted. 


.(b)(1) 

(b)(3)-P.L. 86-36 


authorized under FAA v?705(b) 


I an NSA auditor discovered that a query o f a USP 
l after the Court Order had expired] | 
the selectors were detasked I | 


the analyst was counseled and the query was deleted. 

I.C. (U) Consensual Collection 
(U) Nothing to report. 

I.D. (U) Dissemination of U .S. Identities 

(TS//3I// I'JriThe NSA/CSS enterprise issued i | SIGINT product reports during the 
third quarter ofCY20l2. InnSlGINT produ cts, disseminations wer e found to be improper, 
and the reports were canceled as NSA/CSS and janalysts learned of USPs. 

U S. organizations, or U S. entities named without authorization. All data in the canceled reports 
was deleted as required, and the reports were not re-issued or were re-issued with proper 
minimization. 


I.E. (U) Counterintelligence Activities 

(U) Nothing to report. 


(b)(1) 

(b)(3)-P.L. 86-36 


I.F. (U) Detection and Prevention of Violations (bXsj-PL 86-36 

(b)(3)-50 use 3024(i) 

(l)4T£/,'Sli7MrT To reduce the risk of unauthorized telephony collection and prevent 
violations. NSA/ CSS has instituted a process that gives analysts greater and faster insight into a 
target’s location. 


from NSACSS's principal raw traffic repositories when required. 


ollected data was purgec 


NSA analysts found |_[e-mail accountsl 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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| in the third quarter 

from NSA/CSS’s principal raw traffic repositories when required 
I.G. (U) Other 

(U/ZPOUnf In two instances, database accesses were not terminated when analysts were 
deployed or reassigned to another site. Although not considered violations of E O 12333 or 
related directives, the accesses were terminated 


Collected data was purged 


(b)(1) 

(b)(3)-P.L. 86-36 


II. (U) NSA/CSS Office of the Inspector General (OIG) lO Inspections, 
Investigations, and Special Studies 


(U/ /FOUO) During the third quarter of CY2012. the OIG reviewed various NSA/CSS 
intelligence aaivities to determine whether they had been conducted in accordance with statutes. 
E O.s. AG procedures, and Department of Defense and internal directives. The problems 
uncovered were routine and showed that operating elements understand the restrictions on 
NSA/CSS activities. 


II.A. (U) NSA/CSS Representative!_ I 

(Li yrO UQ) As part of an NSA/CSS OIG field inspection ofNCR P 1 

_an 10 inspector reviewed the implementation ofthe 10 program. 10 training, and 

application of 10 standards in the SIGINT mission activities performed at the site. The inspector 
found that the site lacked an 10Officer (100) structure that ensured the proper handling, 
minimization, and dissemination of raw SIGINT data. The inspector also found that not all 
personnel were compliant with the training requirements. The OIG recommended that an 100 
stnicture be established that complies with current SIGINT policies and procedures and ensures 
adherence to training requirements. 


II.B. (U) 


(b)(3)-P,L. 86-36 


_ (L.’ ' F0 U0 4 As part of an NSA/CSS OIG field inspection ofthe 

I an 10 inspector reviewed 10 program management. 10 training. lO knowledge, 
and the application of 10 standards in mission activities. The inspector found that the site did not 
have procedures to ensure that database accesses were properly terminated after personnel left 
the site, and it did not conduct periodic reviews. Not all personnel had completed the mandatory 
10 training. The OIG recommended that the site develop and implement processes for timely 
access termination, perform periodic reviews, register all 100s as mission auditors, and ensure 
that training is tracked and completed. 


II.C. "(TS//OI//HF) Report on NSA Controls to Comply with the FISC Order 

Regarding Business Records (BR) Collection (b)(1) 

(b)(3)-P,L. 86-36 


(TS/ZSIZ/MF) 


the OIG published the results of a special study of NSA 


controls to comply with the FISC Order regarding BR collection. 


_an OIG auditor performed testing and procedural reviews to assess the Agency's 

compliance and found tiiat. except for one incident reported during the review, no incidents of 
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non-compliance had occurred during CY201L The auditor made recommendations for 
improvement to BR processes to strengthen controls and reduce the risk of non-compliance. 


II D. (U)[ 


10 Program 


^thel I 


(Q I 'RCL TO USA. FVCY) r 


the|_110 Program at the[ 


]the OIG conducted a review otf^)(^) 

■■--1 (b)(3)-P.L. 


s under the operational a nd technical 


86-36 


jthe OIG evaluators 


control of the Director of NSA. In a report published!_ 

cited several weaknesses in the 10 program, including a lack of centralized management oflO 
activities and internal controls. 


I.E. (U) Repo rt on the 


(fi " 11 1 " TK ' "RCL T0U3 A. rVCV) A team, led by the NSA OI G with f 


owned and maintai ned bvt 
data acqui red from 


OIG participation, conducted a study of 


le 


(b)(3)-P.L. 86-36 
b)(3)-50 use 3024(i) 



which is 


The review focused on the processes associated with SIGIN T 


_]and fo und weaknesses in co ntrols for handling and protecting SIGINT data. The 

report, published i 1 included recommendations to address the weaknesses. 


I.F. (U) Misuse of the U.S. SIGINT System 
(U) Nothing to report 
I.G. (U) Congressional and 10 Board Notifications 


(b)(1) 

(b)(3)-P.L. 86-36 


(1) (TE//SI//N P) 


NSA/CSS notified the Conuressional intelliirence 


committees abou t an overcollection ofFAA $702 upstream collection as well as collection uik 
other authorities. I ~ (b)(1) 


NSA has 

deployed a short-term solution to address the problem and is continuing work on a long-term 
solution. 


er 


,L. 86-36 
50 use 3024(i) 


(2) (T9//91//Nr) { I NSA/CSS notified the Congressional intelligence 

committees a bout the unauthorized disclosure of classified national security information derived 
from SIGINTI I 


as well as limit NSA’s access to other sensitive communications in the long term. NSA’s OGC 
has filed a Crimes Report with the Department of Justice. 


(b)(1) 

(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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II.F. (U) Other Notifications 


(b)(1) 

(b)(3)-P.L. 86-36 


(T9//5I//Nr) NSA/CSS notified the AG intelligence-related collection activities 

associated with USP hostaue and detainee cases. 


III. (U) Substantive Changes to the NSA/CSS 10 Program 

(UA‘F OU & ) To improve its management and understanding of the rules and 
interpretations of FISA-related authorities. NSA has established an effort known as “Rules 
Management" to manage, organize, and maintain the authorities, policies, and compliance 
requirements that govern NSA mission activities. One ofthe key components ofthis effort is 
focused on technological solutions to support and simplify rules management. Two systems 
have been created to provide searchable databases that NSA personnel can use to find 
authoritative documents for NSA’s FISA activities, as well as implementing guidance. One 
database is operational. and the system containing the more advanced document management 
and search capabilities is in development. 

IV. (U) Changes to NSA/CSS Published Directives or Policies Concerning 
Intelligence, Counterintelligence, or Intelligence-Related Activities and the 
Reason for the Changes 

(U) Nothing to report. 

V. (U) Procedures Governing the Activities ofDoD Intelligence Components that 
Affect USP (DoD Directive 5240.1-R, Procedure 15) Inquiries or Matters Related to 
lO Programs 

(U) Nothing to report. 

VI. (U) Crimes Reporting 

(U) Nothing to Report 


VII. (U) Other Matters 


(S^^MF) The NSA OIG is investigating an allegation that activity associated with a 

I " " ^ I (b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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